A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A server-side request forgery (SSRF) vulnerability has been identified in PowerJob versions up to 5.1.2. The flaw resides in the function MuConnectionManager.getOrCreateConnection within the TestController.java file of the Transport Endpoint component. An attacker can exploit this vulnerability remotely without authentication. A public exploit is already available, increasing the risk of active exploitation. The vulnerability was responsibly disclosed to the project maintainers via a GitHub issue, but no response or patch has been issued yet. The lack of vendor response leaves users of affected versions exposed to potential SSRF attacks, which could allow attackers to make the server send requests to internal or external resources on behalf of the attacker.